In the special case of training convex models, it turns out there
is a way to directly analyze the privacy of the final learned model [1]}.
This gives a substantially stronger guarantee than can be proven by
summing up the cumulative privacy loss over each iteration of the training
algorithm.
However, for general deep neural networks, there are
no known techniques to achieve this. Hence, we ask the question: does having access to the intermediate model updates allow an adversary to mount an attack that leaks more private information from a deep neural network's training set?
